hyperlquid[.]co[.]com

This domain, hyperlquid.co.com, is flagged for brand_impersonation targeting the Across protocol, a cross-chain bridging platform. Analysis indicates the domain was designed to mimic legitimate Across interfaces, likely to harvest user credentials or facilitate unauthorized transactions under the guise of a trusted service. The page title, 'Hyperliquid - Connect Now,' suggests an attempt to exploit users familiar with crypto wallet connection prompts, a common vector for credential theft or fund diversion. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.67.178.130. At the time of assessment, VirusTotal reported 4 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy. No creation date was provided in the available intelligence, but the use of Cloudflare infrastructure is consistent with tactics to obscure hosting origins and evade detection. The domain is currently offline, reducing immediate exposure risk. However, the elevated risk level persists due to the potential for re-activation or migration to a new domain. Response actions should include monitoring for resurgence under similar naming conventions or infrastructure patterns. Users and organizations are advised to verify domain authenticity before interacting with any crypto-related platforms, particularly those requesting wallet connections. Blocking the IP 172.67.178.130 and domains registered through the same registrar may mitigate residual risk.